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371T- 



312T- 



<signature 
371 — \Z value=" . . 

372 — C pad=". . . 

373— C size=13 

> 

<right 
312— □ value=", 



/> 
<left 

320T- 320— C value=" . 

/> 

<right 

332T- 332— C value=". 

/> 

<left 

340T-] 340^ value=". 

/> 

379THZ </signature> 

I 

r 

300T 

Figure 3 
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Figure 4 
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5.1 N : the natural numbers 0, 1, 2, 3, ... 

5 .2 L : a security parameter for cryptographic hash functions 

5.3 H = S z = set of all bit strings of length L 

5 .4 X* = set of all bit strings of any length 

5.5 F : X* -> H : a cryptographic hash function of output length Z 

5.6 P : a security parameter for a public key signature scheme 

5.7 J-E p = set of all bit strings of length P 

5.8 K E : the space of private keys of the signature scheme 

5 .9 K D : the space of public keys of the signature scheme 

5.10 S EG : K E x J -> J : the signing operation of a private key 

5.11 V EG : K D x J x J B : the verification predicate of a public key 

5.12 H + : positive length sequences of values in H 

5.13 # : H + -> N : the length of a sequence 

5.14 M = {M, } g H + : a sequence of messages 

5.15 n -# M : the number of input messages; also the size of a hash tree 

5.16 Base 1 0 : N Z* : represents a number as an ASCII base - 1 0 integer 

5.17 Base 64 : N -> 5T : represents a number as an ASCII base - 64 integer 

5.18 quote : a constant, the ASCII quote character 

5.19 + : 2T -» X* : string concatenation 

5 .20 B = {true, false } : boolean values 



Figure 5 
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6.1 

6.2 

6.3 

6.4 
6.5 
6.6 

6.7 
6.8 



6.10 



T„ cr N x N : the set of positions in an ordered tree of size n 
K:NxN^N:(i,j}^mm{k\j-i<2 k } 

T n = I 0 < i< j Z n-l a (2^ J> | i)a j = min(/+2* (,j) -l,n-l)} 
T„ + = I (/, 7) J (i, j) €T„ a;'?; j }: the parent nodes in the tree 
T„" = { (z, j) I {/, j) eT„ a (i, j) * (0, n - 1) }: the child nodes in the tree 
Left„ : T„ + -> T„ : (/,,) (*,/ +2^>-' _i) 

Right, :T„ + ^T; :{i,j)»(i + 2 K ^-\j) 
L:NxN -+N:(ti,i)h> L'(n,i,(0,n-l)) 

1 + Z'(n, i, Left„ (r)) when z e Left„ (j) 
I' : N x N x T„ -» N : (n, /, r) h-> i 1 + L'{n, i, Right„ (r)) when i e Right „ (r) 

0 when t = (/,/) 

ordinary,, :NxN->B:(/j}b ((/, /) e T„ ) a (/ = / + 2 K{, ' j) - 1) 



6.11 



"ordinary nodes are stable"o 
V/eNxN;«,neN: (ordinary,, (t) a m > n) -> (ordinary m (?)) 



Figure 6 
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7.1 

7.2 

7.3 
7.4 



VT„ = {N : T„ H} : set of valued trees 

" JV e VT„ is a well - constructed hash tree"o 
Vf , «, v e T„ : » = Left, (r) a v = Right„ (r) -> N{t) = NodeHash„ (t, N{u), N(v)) 

NodeHash„ :T„xHxH->H: ((i, j), x,y)^Fo NodeFormat„ ((/, j), x, y) 
NodeFormat„ :T„xHxH-»2* :a position - dependent formatting function 



s.yr 
3-.£ 



7.5 
7.6 

7.7 

7.8 



N M e VT #M : hash tree generated from leaves M 
N _ : ,^l NodeHas M'^M 0 ^^ when/el- 



when t = (/,/) 



"ordinary nodes have stable values"o 
V/ e T WS M ? P e H + : (ordinary,^) a M c P )-> (N a (t) = N r (t) 

" hash tree iV e VT„ is valid for message sequence M"o 



S'J! 



Figure 7 



|1 
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t ^ //x v [RootFormat(/2,x, v) when (/,/) = (0, n - 1) 

NodeFormat : ( (z A x 9 y)\-±\ \ ) \ 

n ^ 1 1 |ParentFormat(x,j;) when (/ j) e T; n 

RootFormat(rc ? x, .y) ="< root" 

4- "size =" + BaselO(rt) 

+ " left =" + quote+ Base 64(x) + quote 

+ " right =" + quote+ Base 64(y)+ quote 
+ „ /> „ 

ParentFormat(x ? y) ="< node" 

+ " left = n + quote+ Base 64(x)+ quote 
+ " right =" + quote+ Base 64(y)+ quote 
+ "/>" 



Figure 8 



U„ = T„ u {P, S} : node set for combined signature tree 
i? = (0, n - 1) e T„ cz U„ : root node of hash tree 
"parent(/?) = P 
_parent(p) = ,S' 



Figure 9 
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10.1 



10.2 



10.3 
10.4 



VU„ = {n : U„ -> E* }: set of valued trees 
"N e VU„ is a well -constructed combined signature tree"o 

vV| T is a well - constructed hash tree" 
AAf(i?) = PadStrip(JV(p)) 
A3deK D :V m (d,N(s\N(P)) 

N eM,z 6 '• com bined signature tree generated by e e K E , M e H + , z e E 

PadFormat(jV ^ >z (4 z) if « = P 
N n {u) ifweX,,- 



iV. i7 , : a i-H 



01 



10.5 



"combined signature tree N e VU„ is valid for d e K D ,M e H + "o 
" JV is a well - constructed combined signature tree" 
AV EG (d,N(s\N(P)) 
AN(R) = N n (0,#M-l) 



Figure 10 



11.1 

11.2 
11.3 
11.4 
11.5 
11.6 



PadFormat : H x Z P ' L J : hash value padding function 

PadFormat : (h, z) i-» h + z 

PadStrip : J -> H : pad stripping 

PadStrip: y'h-> j'[0,Z-l] 

Padding : J -> Y, P ~ L : pad extraction 

Padding: yh-> y'^P-l] 



1 1 .7 " inverse on first parameter" <=> V h, z e E* : h = PadStrip(PadFormat(/z, z)) 

1 1.8 "inverseon second parameter" <=> V/i,ze E* :z = Padding(PadFormat(/z, z)) 



Figure 11 
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12.1 L = L(n, /); k, i e [0, « - 1] : sequence parameters 

12 - 2 B n ,,fi> B n,.,i>~-> B n,iM\ eT » :branchnodes 

12.3 S„ h0 ,S nil ,..., S n>lL eT n : sibling nodes 

12.4 side ni0 ,side nil ,...,side niL e {"left", "right"}: sibling positions 



12.5 
12.6 



5 „,,,2. + i = (M-l): root node 

["left" when /€ Right, (5.^) 
sie »,t |„ right „ when/eLeftn (^ a+i ) 

= fLeft„(5„ a+! ) when5^„, ji = "left" 

[Right, fo^J when ^„ a = "right" 

jRight^J when ^ >a = "left" 

|Left„(5 ttj)>i+1 ) when 5/^,,= "right" 



12J ^ = | R igl 
12.8 



Figure 12 
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ExtractedSignature :K f xH*x Yf~ L xN->E' 
SiblingSeq:H + xNxN->2* 

ExtractedSignature :(e,M, z, ij 



SiblingSeq:(M,r,A:) 



i->i 



SignTagStart(^ igz (5), Z ,#M) 

+ SiblingSeq(M,r,o) 
+ SignTagEndQ 

SibTag(si& #Ji? , , N n (s #A7 J) 



+ 



SiblingSeq(M,/,A: + l) 



whenAr<l(0,#M-l) 
when£ = L(o,#M-l) 



SignTagStart : J x 2* x N -» E* : (j, z, n) h-> 



"< signature" 
+ " value -'+ quote+ Base64(/')+ quote 
+ " pad ="+ quote+ Base 64(z)+ quote 
+ "size="+BaselO(«) 



SignTagEnd: : hV'< /signature >" 



SibTagiZTxH^E* :(j,v)i-> 



"<"+£ 

+ "value ="+ Base 64(v) 

+ "/ >" 



Figure 13 
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14. 1 extracted signature : 



14.2 
14.3 
14.4 

14.5 
14.6 



sig e J : signature value 
zeE M : padding bits 
«eN: stated size of the tree 
L e N : number of siblings on branch 
A> • • • Pl-i e {teft> right} : position indicators 
)...^.,sH: sibling values 
X5eK D xHxJxE p - i xNxNx {left, right} + x H + : extracted signature verification 
XS = (d,M, sig, z, n, L, {p 0 ... p L _ x }, {s 0 . . . s L _, }) 

W L ={S 0 ...S L _ 1 ,B 0 ...B L ,P}: nodes of the base tree of a verification tree 
parent^, ) = B l+1 

parent(#, ) = B I+l , when i<L : edges of the base tree of a verification tree 
parent(5 i ) = P 

N s e VW L = {N : W L r J: verification tree 



14.7 



14.8 



M whenw = 5 0 

s , when w = S, 

•V -., : ;ri- <{ NodeHash^P^,),^^),^^)) when y V = B„0<iZL,p l =left 

NodeHash B (/»(*, ), JV^ \ (S^ )) when w = B„0<i<L,p,= right 
PadFormatfc(5jz) 

Left„ ) when w = B l ,i<L 9 p 1 = right 
P^:{B 0 ...B L }^T n :wH><Right„(B J+l ) when w = B i9 i<L,p, =left 

(0,n-l) when w = B L 



14.9 "signature is valid for (d 9 Af )" 



" signature is well - formed" 
a i^(i? 0 ) is defined 
a3i:^(* 0 ) = (i,i) 



Figure 14 
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external sender(s) 
message arrival 



1901 
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idle 
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hash tree constructor 
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2110 



Idle 



Waiting 



2011' ready 



t r 



message 



Sending 
entry / sendWorkspace 



2013 




Constructing 
entry / computeOrdinary 



Figure 20 




2100 

V Idle 



2101 2102 



Waiting 
entry /sendReady 



2104 



Sending 
entry / sendTree 



Completing 
entry / completeTree 



Signing 
entry / signTree 



2106 Figure 21 
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2211 [at end] m 
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Figure 23A 



23 .7.3 NodeHash^ :HxH->H:(xj)h F(safr + NodeFormat„ (x ? y)) 

"< signature" 



23.13.5 SignTagStart : JxH-»E* :{j,salt)^ 



+ "value ="+quote+ Base64(/)+ quote 
+ "salt ="+quote+ Base64(ja//)+ quote 



Figure 23B 



o/! o 1 xt a t: * //. a \ fLayerFormat("bottom",x,y) when|/-y| = l 
24.8.1 NodeFormat n :((zAjc, v)i->< ; ^ y 1 Jl 

[LayerFormat("top'\ x, y) otherwise 

LayerFormat(«0/we, x, y) - ' <" + + 

+ " left =" + quote+ Base64(x) + quote 



24.1 

+ " right = H + quote+ Base64(» + quote 
+ "/>" 



Figure 24 
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25.8.1 NodeFormat n : ((zj), x, >>) 



"<node" + 
+ "pos =" + BaselO(/)V\ n +BaselO(/) 
+ " left =" + quote + Base 64(x) + quote 
+ " right =" + quote + Base 64(y) + quote 

+ "/>" 



Figure 25 




M 0 )f M 1 U M 2 J( M 3 



Figure 26A 



9*7* a/ .^lNodeHash #jg (r,^oLeft„(/),^oRight„(r)) whenfel^ 
Zo./.o TV .-7. ri— , . . . 

M [LeafHash(M, ) when t = {?', z) 

26. 1 LeafHash :NxH-^H:xh F(LeafForraat(x)) 
LeafFormat^) ="< leaf 



26.2 



+ " value =" + quote + Base64(x) + quote 

+ "/>" 



Figure 26B 
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<signature 
2771^ value=" . 

2773— Q size=13 
> 

Figure 27 




i 

2800 
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29 J = W L \ P : nodes of the base tree of a verification tree 

292 N xs = N xs | : verification tree 

29.3 V MR : x J — > J : message recovery operation for signature verification 



29.14.9 "signature is valid for {d,M) n 



"signature is well - formed" 
a Pxs(B 0 ) is defined 
A3i:P xs {B 0 ) = (i,i) 
a PadStripo V m (d 9 sig) = N xs (B L ) 



Figure 29 



I; J 



